REDHAT-BUG-599564: Medium severity Ghostscript Ghostscript vulnerability

Published Jun 3, 2010

Updated

Security flaws were found in the way gs handled its initialization: 1, library search path include '.' (current working directory) by default, causing ghostscript to search '.' for initialization and library postscript files 2, explicit use of "-P-" command line option, did not prevent ghostscript from executing PostScript commands, contained within "gsinit.ps" file.

A local attacker could use this flaw to execute arbitrary PostScript commands, if the victim was tricked into opening a PostScript file in the directory writeable by the attacker

References: [1] http://bugs.ghostscript.com/showbug.cgi?id=691339 [2] http://bugs.ghostscript.com/showbug.cgi?id=691350 [3] http://www.securityfocus.com/archive/1/511433 [4] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583316 [5] https://bugzilla.novell.com/showbug.cgi?id=608071 [6] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583183

Affected Software

1 affected component

Ghostscript Ghostscript

Event History

Jun 3, 2010

Data Sourced

via Red Hat·02:06 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-599564?

The severity of REDHAT-BUG-599564 is considered high due to the potential for unauthorized access and execution of arbitrary code.

How do I fix REDHAT-BUG-599564?

To fix REDHAT-BUG-599564, update Ghostscript to the latest version where the vulnerabilities have been addressed.

Who is affected by REDHAT-BUG-599564?

Users running Ghostscript are affected by REDHAT-BUG-599564, particularly those using versions prior to the patch release.

What are the risks associated with REDHAT-BUG-599564?

The risks include exploitation via malicious initialization files, which can lead to system compromise.

When was REDHAT-BUG-599564 reported?

REDHAT-BUG-599564 was reported in June 2023, highlighting critical security flaws in Ghostscript.